MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba67d024c6264c6a754526d08ae6d0cf0a9531a351fe962a62a7d1e4f47e0629. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ArkeiStealer

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	ba67d024c6264c6a754526d08ae6d0cf0a9531a351fe962a62a7d1e4f47e0629
SHA3-384 hash:	a16c1c412b596317372018d99168715afaad9d59ecc3101130f059d4d5e8d5db04e4eb1b61b4d3b386e189d8b0ac0e99
SHA1 hash:	b758a83db46344b2dbef1c303d3058b97631fe1e
MD5 hash:	131296e016a70ea67760fa6eec3dca8f
humanhash:	violet-quebec-california-golf
File name:	SecuriteInfo.com.Trojan.GenericKD.46337847.25215.12830
Download:	download sample
Signature	ArkeiStealer Create hunting rule
File size:	3'408'040 bytes
First seen:	2021-05-26 23:38:09 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	55ec7ca1752f870a6cb9cfb7847d0a6a (1 x ArkeiStealer)
ssdeep	49152:PX1uDOr+DXOs8E5q0F+aZL397D7GDhOYKk9h:Plh+Oz0/VRDKDYHUh
TLSH	8AF539E6EA1943BED05524BC18D3D34743A493BA0618AB06DDDD3C74B99293C2F937AC
Reporter	SecuriteInfoCom
Tags:	ArkeiStealer signed

Code Signing Certificate

Organisation:	Google Softe Dev LLC
Issuer:	Google Softe Dev LLC
Algorithm:	sha1WithRSAEncryption
Valid from:	2021-01-17T20:19:47Z
Valid to:	2031-01-18T20:19:47Z
Serial number:	134426b4c1fed1864d1218ab259225fe
Thumbprint Algorithm:	SHA256
Thumbprint:	9dc82f47d25988a590f4e7f89e217d1e57e9fd53c4992692f8ae15285fd847a9
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

124

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

SecuriteInfo.com.Trojan.GenericKD.46337847.25215.12830

Verdict:

Malicious activity

Analysis date:

2021-05-26 23:41:41 UTC

Tags:

trojan stealer vidar

Link:

https://app.any.run/tasks/7015d3f1-fa4a-4fe8-99b6-a0a3f19a4ff3

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/162609/

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.46337847.25215.12830.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for analyzing tools

Searching for the window

DNS request

Sending a custom TCP request

Connection attempt

Sending a UDP request

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Vidar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/792971

Signature

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ba67d024c6264c6a754526d08ae6d0cf0a9531a351fe962a62a7d1e4f47e0629/

Threat name:

Win32.Trojan.Chapak

Status:

Malicious

First seen:

2021-05-22 03:48:26 UTC

File Type:

PE (Exe)

AV detection:

25 of 47 (53.19%)

Threat level:

5/5

Result

Malware family:

n/a

Score:

9/10

Tags:

evasion spyware stealer themida trojan

Link:

https://tria.ge/reports/210526-554k2y51ax/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses 2FA software files, possible credential harvesting

Checks whether UAC is enabled

Checks BIOS information in registry

Reads user/profile data of web browsers

Themida packer

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/ba67d024c6264c6a754526d08ae6d0cf0a9531a351fe962a62a7d1e4f47e0629

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.